Malicious npm Package nodejs-smtp Mimics Nodemailer, Targets Atomic and Exodus Wallets

A malicious npm package named nodejs-smtp impersonates nodemailer and was uploaded to the npm registry in April 2025, attracting a total of 347 downloads before it was removed. Cybersecurity researchers describe how, on import, the package uses Electron tooling to unpack Atomic Wallet’s app[.]asar, replace a vendor bundle with a malicious payload, repackage the application, and delete its working directory to hide traces, according to Socket researcher Kirill Boychenko.

The package’s main objective is to overwrite the recipient address with hard-coded wallets controlled by the threat actor, redirecting BTC, ETH, USDT and TRX USDT, XRP and SOL transactions to effectively function as a cryptocurrency clipper. Despite this, the package still operates as a drop-in SMTP-based mailer compatible with nodemailer, allowing tests to pass and remaining plausible to developers.

Found to impersonate the legitimate nodemailer, nodejs-smtp attracted attention after it was uploaded by a user named “nikotimon” and is now no longer available. This campaign builds on prior research that unpacked wallet-related app archives to introduce clipper functionality into Atomic and Exodus wallets on compromised Windows systems.